#OpenBao Deployment Guideline

global:
  # Bring-up only. TLS is MANDATORY for production — the connection carries
  # unwrapped volume keys. Enable it in step 8 before any productive use.
  tlsDisable: true

# The volume-encryption use case does not need the secrets sidecar injector.
injector:
  enabled: false

server:
  image:
    repository: openbao/openbao
    tag: "2.5.5"

  # Static-token auth only (step 7) — the Kubernetes auth delegator is unused.
  authDelegator:
    enabled: false

  # Create all three pods at once. A sealed pod is NotReady, and the chart default
  # (OrderedReady) would wait for each pod to become Ready before creating the
  # next — making the initial "unseal all three" loop in step 3 impossible.
  podManagementPolicy: Parallel

  ha:
    enabled: true
    replicas: 3                           # odd for quorum; tolerates 1 failure. Use 5 to tolerate 2.
    raft:
      enabled: true
      setNodeId: true                     # node_id = pod name (openbao-0/1/2)
      config: |
        ui = true

        listener "tcp" {
          address         = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_disable     = true          # PRODUCTION: false + tls_cert_file/tls_key_file (step 8)
        }

        storage "raft" {
          path = "/openbao/data"
          # With TLS (step 8) change http to https AND add
          # `leader_ca_cert_file = "/openbao/userconfig/openbao-server-tls/ca.crt"`
          # to each stanza.
          retry_join { leader_api_addr = "http://openbao-0.openbao-internal:8200" }
          retry_join { leader_api_addr = "http://openbao-1.openbao-internal:8200" }
          retry_join { leader_api_addr = "http://openbao-2.openbao-internal:8200" }
        }
        # NOTE: Raft Autopilot cannot be set in this config — OpenBao silently
        # ignores an `autopilot` stanza here. Set it at runtime instead (step 4).

        service_registration "kubernetes" {}

        # Audit log on the persistent audit volume (auditStorage below).
        # Audit devices are configured declaratively here — OpenBao 2.5+
        # rejects the API-based `bao audit enable`.
        audit "file" "file" {
          options = {
            file_path = "/openbao/audit/audit.log"
          }
        }

        # PRODUCTION auto-unseal — uncomment ONE and configure BEFORE the first init
        # (step 3). Without it, every pod restart needs a manual unseal.
        # SECURITY: do not inline the PIN/token here (this config renders into a
        # ConfigMap) — inject it via environment variables from a Secret
        # (chart value `server.extraSecretEnvironmentVars`).
        # seal "pkcs11"  { lib = "/path/to/your-hsm-pkcs11.so" slot = "0" key_label = "openbao-unseal" }
        # seal "transit" { address = "https://bootstrap-bao:8200" key_name = "autounseal" mount_path = "transit" }

    disruptionBudget:
      enabled: true
      maxUnavailable: 1                    # never evict more than one voter at a time

  # Pin to ONE worker pool whose zones are the real availability zones
  # (see the note below). Adapt the pool name to your shoot.
  nodeSelector:
    worker.gardener.cloud/pool: <worker-pool-name>
  # One replica per zone (3 availability zones) ...
  topologySpreadConstraints: |
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfiable: DoNotSchedule
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: {{ include "openbao.name" . }}
          app.kubernetes.io/instance: {{ .Release.Name }}
          component: server
  # ... and never two on the same node.
  affinity: |
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchLabels:
              app.kubernetes.io/name: {{ include "openbao.name" . }}
              app.kubernetes.io/instance: {{ .Release.Name }}
              component: server
          topologyKey: kubernetes.io/hostname

  dataStorage:
    enabled: true
    size: 10Gi                            # Raft data; size for your usage
    storageClass: default                 # must be an UNENCRYPTED StorageClass

  # Persistent audit volume (step 10). Without it, audit logs are lost on restart.
  auditStorage:
    enabled: true
    size: 5Gi
    storageClass: default

  resources:
    requests: { cpu: 250m, memory: 256Mi }
    limits:   { memory: 512Mi }

  # Active and standby nodes report Ready; a sealed node does not. This drives the
  # PodDisruptionBudget and rolling updates correctly.
  readinessProbe:
    enabled: true
    path: "/v1/sys/health?standbyok=true"

  # With manual (Shamir) unseal, OnDelete lets you restart and unseal one pod at a
  # time so a rollout never seals the quorum. With auto-unseal, RollingUpdate is
  # fine — pods unseal themselves on restart.
  updateStrategyType: OnDelete

  standalone:
    enabled: false

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kms-token-renew
  namespace: kube-system
spec:
  schedule: "0 */8 * * *"                  # three times per 24h period
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: renew
              image: openbao/openbao:2.5.5
              command: ["bao", "token", "renew"]
              env:
                - name: BAO_ADDR
                  value: "http://<openbao-active-clusterip>:8200"
                - name: BAO_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: kms-token
                      key: token

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: selfsigned
  namespace: openbao
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: openbao-ca
  namespace: openbao
spec:
  isCA: true
  commonName: openbao-ca
  duration: 87600h                    # 10 years
  secretName: openbao-ca
  issuerRef:
    name: selfsigned
    kind: Issuer
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: openbao-ca
  namespace: openbao
spec:
  ca:
    secretName: openbao-ca

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: openbao-server-tls
  namespace: openbao
spec:
  secretName: openbao-server-tls
  duration: 43800h                    # 5 years
  dnsNames:
    - openbao-0.openbao-internal
    - openbao-1.openbao-internal
    - openbao-2.openbao-internal
  ipAddresses:
    - <openbao-active-clusterip>
    - 127.0.0.1
  issuerRef:
    name: openbao-ca
    kind: Issuer

server:
  extraVolumes:
    - type: secret
      name: openbao-server-tls        # mounted at /openbao/userconfig/openbao-server-tls